Executive brief
Open ISES Tickets is an open-source issue tracking system. A security flaw in the software allows an attacker to send a malicious link to a logged-in user that, if clicked, executes unauthorized code in their web browser. This could allow an attacker to steal session information or perform actions on behalf of the user within the ticketing system.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The root cause is the improper neutralization of the 'ticket_id' GET parameter in the 'add_note.php' file, which is reflected directly into the VALUE attribute of a hidden HTML input field without sanitization. An authenticated attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the payload executes in the context of their browser session. The vulnerability was addressed in version 3.44.2 by implementing input validation using the 'htmlspecialchars()' and 'intval()' functions.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to repository
- 2026-04-02: advisory: Version 3.44.2 released
- 2026-05-20: disclosed: CVE published and NVD entry created